REALSEC faces the Financial security challenge with cryptographic solutions

The application of cryptographic technologies to comply with the security needs in the banking and financial environment and in payment methods is a standard business requirement. In this article, REALSEC explains how this challenge has evolved in recent years creating the need within the banking sector, and tells us about their cryptographic solutions.
The older security solutions used in the Financial and Banking environment had been overtaken by criminal organizations, who were specialized in attacking magnetic stripe card technology to achieve their goals fraudulently, leaving these systems obsolete. This has led to the need for renovation; which has not only resulted in mandatory legal regulations but also makes it a prerequisite for a business to function properly.
Jesús Rodríguez Cabrero, President and CEO of REALSEC, states in his blog: “The objective that banks are striving for with the use of the new smart cards has been to strengthen the use of plastic money, reduce the risks of fraud detected in magnetic stripe cards, and put an end to extortion by criminal organizations“. The CEO adds: “in the past decade, Banking has abandoned the use of encryption based on DES algorithm, which has been discontinued and replaced by the 3DES algorithm that is regarded as a secure encryption algorithm by the scientific and mathematical community“.
With the traditional PIN code verification, cryptography was only used as protection in the process of transporting that code. Now, with the use of EMV cards, a cryptographic exchange occurs between the chip card and the issuing bank such as complex script for special operations; for example, changing the PIN number. As a result, the demand has increased considerably for cryptographic calculation to process each transaction performed with the new cards. For this reason, banking has had to implant more powerful and certified FIPS 140-2 Level 3 cryptographic hardware systems in their card authorizing centers to meet the most demanding security requirements.
On the other hand, we have the new regulation requirements to protect the cardholder data that includes the encryption of the data during the transfer, storage, and custody processes; which the payment-related organizations are required to comply to. We are referring to Payment Card Industry Data Security Standard (PCI DSS), a PCI regulation, which immerged from the agreement of the financial services corporations providing payment methods (VISA, Mastercard, American Express etc.).
Rodríguez Cabrero explains in his blog: “Although PCI regulations do not specifically determine the type of encryption algorithm to use, neither does it make reference to; in the case of the merchant, whether the encryption should be done by (HSM) hardware or software. It does, however, set the security level that is required. This is a breakthrough in terms of the use of encryption systems to protect and watch over the cardholder data, and therefore avoid the risks of fraud by the improper use of this data“.
The implementation of cryptographic commands in the Banking environment, the introduction of EMV cards, updating ATM passwords, the use of digital signatures to combat Phishing… are all common needs in the financial world, to which Realsec offers diverse solutions.
H3P: Preparation System for Card Personalization Processes
The H3P tool solves all the problems associated with the EMV/CEPS card personalization process. It enables the generation of files for the personalization of credit cards with chip, i.e., those corresponding to the EMV (Visa, Mastercard), common electronic purse specifications (CEPS), and multi-application cards whether they have financial applications or not.
H3P has been created and adapted for the specific problems banks have that are associated with Servired so that it accurately reflects the requirements and exact format of these entities. Nevertheless, H3P is designed to be easily modified by adapting smoothly to other work methods for a specific problem.
H3P, through a simple and intuitive interface, allows the user to define the card structure that will be used, and therefore avoid having to control at a low-level the data structure. The defined profiles are stored in simple files, which by using XML syntax, accurately reflect in each product/card the data structure, passwords, and specific certificates that should be included for personalization. These files are readable and directly editable if that is the user’s preference.
For further information about this solution click HERE
Cryptosec Banking: Server with Cryptographic Banking Functions
Presenting a cryptographic server in a pre-installed network that offers maximum security guarantees with complex cryptographic functions for the Banking sector. Easy installation in rack, it occupies only 1U, and has a very large function library; including as well as standard cryptographic functions, all the necessary functions for Banking and Payment Methods.
For further information about this solution click HERE
Cryptosec RKL: Server for remote upload of passwords for ATM’s and POS’s
Cryptosec RKL
Integrated server: Hardware/software, Remote upload application and HSM. Standard EPP XFS-based client/server architecture. Multi-vendor client software: DIEBOLD, NCR, WINCOR, FIJITSU etc. High security and protection of passwords: TAMPER RESISTANT and RESPONSIVE. Independent HOST system and self-services. Standard communication protocols: TCP/IP, X.25 etc. Generation and verification of passwords and signatures in HSM (FIPS 140-2 Level 3 certificate). System based on ANSI standards and VISA and MASTERCARD standards. High demand and cryptographic acceleration. Adheres to ANSI X 9 standards. Definable distribution frequency.
For further information about this solution click HERE

Source: Hay Canal

No Comments

Post a Comment